EUVD-2026-31138
GHSA-2fmj-cw46-4vrm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
Lifecycle Timeline
4DescriptionCVE.org
In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause a Denial of Service by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible because of missing input validation in the coldToFrozen.sh script, which accepts arbitrary file paths and renames them without restricting operations to safe directories.
AnalysisAI
Denial of Service in Splunk Enterprise and Splunk Cloud Platform allows a low-privileged authenticated user to render the entire instance non-functional by exploiting missing input validation in the coldToFrozen.sh script bundled with the splunk_archiver app. The script accepts arbitrary file paths and renames them without restricting operations to safe directories, enabling renaming of critical Splunk system directories. No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege requirement (PR:L per CVSS) makes this actionable for any authenticated non-admin user in multi-tenant or enterprise deployments. A vendor patch is available via advisory SVD-2026-0504.
Technical ContextAI
The coldToFrozen.sh shell script is part of Splunk's splunk_archiver application, which manages the data lifecycle by transitioning index buckets from cold storage to frozen (archived or deleted) states. The vulnerability is rooted in CWE-20 (Improper Input Validation): the script accepts a user-supplied file path argument and performs a rename operation on it without enforcing any path restriction or allowlist to confine operations to legitimate data directories. This means an attacker can supply an absolute path targeting critical Splunk configuration or runtime directories outside the archiver's intended scope. Affected products are confirmed via CPE strings cpe:2.3:a:splunk:splunk_enterprise and cpe:2.3:a:splunk:splunk_cloud_platform across multiple version branches. The root cause is a missing directory traversal guard in a privileged shell script executed in the context of the Splunk process, rather than a memory corruption or injection issue.
RemediationAI
Upgrade Splunk Enterprise to the patched releases: 9.3.12, 9.4.11, 10.0.5, or 10.2.2 depending on the branch in use. Splunk Cloud Platform customers should ensure their instances are running 9.3.2411.129, 10.0.2503.13, 10.1.2507.21, 10.2.2510.11, 10.3.2512.9, or 10.4.2603.1 or later. Vendor patch is confirmed available via Splunk advisory SVD-2026-0504 at https://advisory.splunk.com/advisories/SVD-2026-0504. If immediate patching is not feasible, a compensating control is to revoke access to the splunk_archiver app for all non-administrative users - this restricts which users can invoke the coldToFrozen.sh script, though it may impact legitimate archiving workflows. Additionally, consider restricting Splunk role assignments so that only trusted users hold any Splunk account, reducing the population of potential attackers. Note that these workarounds do not eliminate the underlying vulnerability and patching remains the definitive fix.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today